equilibrium[.]ink

On 24 July 2026 the domain equilibrium.ink was observed resolving to the IP address 199.59.243.225, which is registered to AS16509 Amazon.com, Inc. and geolocated in the United States. The site presented a page title of "Equilibrium.ink" and did not serve an SSL certificate, indicating traffic was delivered over plain HTTP. Analysis of the host infrastructure shows the domain is registered through ARIN and is associated with a single nameserver, though the nameserver details are not disclosed. The site was identified as employing the Airdrop Scam phishing kit, a known template used to lure victims with cryptocurrency airdrop promises.

Security telemetry places equilibrium.ink on two independent blocklists—PhishDestroy and ScamSniffer—both of which have flagged the domain for malicious activity. A Gridinsoft trust score of 0 out of 100 further reflects a lack of confidence in the site’s legitimacy. VirusTotal recorded scans from 95 antivirus engines, none of which raised a detection at the time of scanning; however, the absence of detections does not constitute a safety assurance. The domain’s current operational status is reported as offline, suggesting the operators have taken the site down, either temporarily or permanently.

Uncertainties remain regarding any additional payloads, redirection chains, or credential harvesting mechanisms that may have been present while the site was active, as no visual or content analysis is available. Defenders should continue to block the resolved IP address and the domain name at network perimeters, monitor for re‑registration or re‑activation of the domain, and consider adding the domain to internal threat intel feeds. Ongoing observation of the associated ASN and blocklist updates is recommended to detect any resurgence of the Airdrop Scam infrastructure.